From 3d931d0f5a0c9665774c34ce894ce4a4a9c932c0 Mon Sep 17 00:00:00 2001 From: Klemens Nanni Date: Sun, 6 Jun 2021 23:00:43 +0000 Subject: OpenBSD: pledge minimum promises from the start catgirl needs: - "stdio tty" at all times - "rpath inet dns" once at startup for terminfo(5) and ssl(8) - "proc exec" iff -R/restrict options is disabled - "rpath wpath cpath" iff -s/save or -l/log options is enabled Status quo: catgirl starts with the superset of all possible promises "stdio rpath wpath cpath inet dns tty proc exec", drops offline with "stdio rpath wpath cpath tty proc exec" and possibly drops to either of "stdio rpath wpath cpath tty", "stdio tty proc exec" or "stdio tty" depending on the options used. Such step-by-step reduction is straight forward and easy to model along the process runtime, but it comes with the drawback of starting with too broad promises right from the beginning, i.e. `catgirl -R -h host' is able to execute code and write to filesystems even though it must never do so according the (un)used options. Lay out required promises up front and pledge in two stages: 1. initial setup, i.e. fixed "stdio tty" plus temporary "rpath inet dns" plus potential "rpath wpath cpath" plus potential "proc exec" 2. final rutime, i.e. fixed "stdio tty" plus potential "rpath wpath cpath" plus potential "proc exec" This way the above mentioned usage example can never execute or write files, hence less potential for bugs and more accurate modelling of catgirl's runtime -- dropping "inet dns" alone in between also becomes obsolete with this approach. --- chat.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/chat.c b/chat.c index 19ca3d3..1c8e37c 100644 --- a/chat.c +++ b/chat.c @@ -311,7 +311,17 @@ int main(int argc, char *argv[]) { #ifdef __OpenBSD__ if (self.restricted) unveilAll(trust, cert, priv); - int error = pledge("stdio rpath wpath cpath inet dns tty proc exec", NULL); + + char promises[64] = "stdio tty"; + struct Cat cat = { promises, sizeof(promises), strlen(promises) }; + if (save || logEnable) catf(&cat, " rpath wpath cpath"); + if (!self.restricted) catf(&cat, " proc exec"); + + char *promisesFinal = strdup(promises); + if (!promisesFinal) err(EX_OSERR, "strdup"); + + catf(&cat, " rpath inet dns"); + int error = pledge(promises, NULL); if (error) err(EX_OSERR, "pledge"); #endif @@ -330,10 +340,6 @@ int main(int argc, char *argv[]) { uiDraw(); int irc = ircConnect(bind, host, port); -#ifdef __OpenBSD__ - error = pledge("stdio rpath wpath cpath tty proc exec", NULL); - if (error) err(EX_OSERR, "pledge"); -#endif if (pass) ircFormat("PASS :%s\r\n", pass); if (sasl) ircFormat("CAP REQ :sasl\r\n"); @@ -364,12 +370,9 @@ int main(int argc, char *argv[]) { } #ifdef __OpenBSD__ - char promises[64] = "stdio tty"; - struct Cat cat = { promises, sizeof(promises), strlen(promises) }; - if (save || logEnable) catf(&cat, " rpath wpath cpath"); - if (!self.restricted) catf(&cat, " proc exec"); - error = pledge(promises, NULL); + error = pledge(promisesFinal, NULL); if (error) err(EX_OSERR, "pledge"); + free(promisesFinal); #endif struct pollfd fds[] = { -- cgit 1.4.1